What Four Federal Funding Deadlines Mean for Your SLED Pipeline

If you sell into SLED, there's a date you probably haven't marked: December 31, 2026.

‍

That's the day ARPA money stops being spendable. Treasury's guidance is clear about what happens to anything left over: it goes back to the Treasury. There's no extension and no rolling it into next year.

‍

Right now, in forecast reviews everywhere, a rep is walking through a deal that's signed, with implementation starting in January and revenue landing in Q1. Everyone nods. Nobody asks where the money came from. And if the answer is ARPA, that deal has a problem that has nothing to do with whether it closes.

‍

Four federal programs have paid for a lot of the SLED technology bought since 2021: ARPA, the State and Local Cybersecurity Grant Program (SLCGP), ESSER (the pandemic relief money that went to K-12 schools), and Medicaid systems funding. Three of them are winding down, each on its own schedule. The fourth isn't ending at all. It's permanent, and a new compliance deadline just handed states something new they have to build.

‍

One quick explanation before you read on: Obligated means the government has legally committed the money: signed a contract, cut a purchase order, made a subaward. Spent (Treasury says "expended," the Department of Education says "liquidated") means the cash has actually left the account. Every federal program sets separate deadlines for the two, and the gap between them is where deals can get stranded.

‍

Let's walk through all four: what each funded, when it ends, and what you should change in your pipeline this quarter because of it. If you're short on time, remember these four things.

• ARPA money has to be spent by December 31, 2026. Not obligated — spent. The deadline everyone remembers passed twenty-one months ago.
  
  • Do this: run your Q4 commit against payment dates, not close dates, so you catch the at-risk deals while there's still time to phase delivery or move them out of the quarter.
• SLCGP stopped taking applications, and roughly $370M of FY24 and FY25 awards is still being competed anyway — at the state level, into 2029.
  
  • Do this: build SLED cyber coverage around state sub-grant calendars instead of one federal cycle, so you see the windows while they're open, instead of after they close.
• ESSER is closed. Every K-12 renewal originally bought with it now has to win general funds.
  
  • Do this: segment your K-12 base by original funding source before FY27 planning closes, so those renewals get an earlier motion and a general-fund business case instead of turning into surprise churn.
• Medicaid systems money is permanent, and it just got a deadline. States have to stand up community engagement verification by January 1, 2027, and the federal government covers 90% of what it costs to build.
  
  • Do this: put state health and human services agencies in the FY27 territory plan, so you're in the conversation while requirements are still being written rather than after the RFP posts.

‍

‍

An ARPA deal can close this quarter but you might not get paid

Let's go back to that forecast review.

‍

The December 2024 deadline everyone remembers was the obligation deadline, the date by which a government has to commit its money to something. It got all the coverage, it passed twenty-one months ago, and it's why a lot of teams have quietly filed ARPA under "handled."

‍

The expenditure deadline is December 31, 2026, and it means cash out the door, vendors paid.

‍

So the question you've been asking in the forecast review doesn't actually tell you anything about these deals. "Will it close this quarter" is the wrong test. The real test is whether the work can be delivered, invoiced and paid before December 31. A deal that signs on December 10 with a twelve-week implementation isn't a Q4 win — it's a deal whose funding evaporates halfway through deployment, and you find out about it in February.

‍

What you should do: Pull every open opportunity funded by ARPA and sort it by implementation length rather than close date. ARPA money goes by SLFRF in most government paperwork, so look for both. "We don't record funding source in our CRM" — if that's you, start with your largest open SLED deals and ask the AE where the money came from. Moving forward, add funding source as a field that you track.

‍

Anything that can't finish and collect inside eleven weeks needs a different conversation now, while there's still room for phased delivery, partial invoicing, or an honest move out of the commit. Then look past the deal to the renewal, because whatever came off ARPA in 2024 renews against a general fund line in FY28. Your buyers may look more critically at the price the next time around.

‍

The point is to do this in October, while you can still do something about it. In February all that's left is explaining why you missed your number.

‍

‍

The cyber grant money didn't disappear — it moved to 56 state calendars

If your team stopped tracking SLCGP when it expired, that was a perfectly reasonable call to make. It may, however, also be why there's pipeline sitting there that nobody is working.

‍

The federal tap really is off. The four-year authorization from the infrastructure law ran out in September 2025 and hasn't come back with new money. FY25 was the last funding opportunity, and applications closed over a year ago. Reauthorization bills haven't cleared the Senate.

‍

So why spend any time on a program that's over? 

Because the money already awarded is still very much in play. Roughly $370 million from the last two award years, FY24 and FY25, sits inside performance periods that run to 2029. And every one of the 56 state and territory recipients has to pass at least 80% of its award through to local governments, with a quarter of that reaching rural jurisdictions.

‍

So the competition didn't end, it just moved down a level to the states, where it's running right now, Wisconsin's window is open as I write this. We checked three states to see what that looks like on the ground. Not a survey of all 56, but three real calendars you can go look at yourself:

‍

‍

Look at Wisconsin. It's still handing out FY24 money in late 2026, two award years behind. A closed window in one state tells you nothing about the state next door.

‍

If you're wondering whether any of this is relevant to what you sell, Wisconsin's published eligible-use list reads like someone copied it off a security vendor's pricing page: multi-factor authentication, managed detection and response, endpoint and extended detection and response, security awareness training, internet edge security, .gov migration, vulnerability management, immutable cloud backups, and penetration testing.

‍

What I'd do here is two things. First, find out who's actually paying. These grants often don't cover the whole bill, the city or county has to fund part of the project itself which grant programs call a match. That means your buyer needs their own budget on top of the federal money, and if they don't have it the deal stalls no matter how badly they want the product. How much they owe varies: federal rules set it at 40%, or 30% when several agencies apply together, but states can waive it. Wisconsin waived it entirely for the round that's open now, and is telling applicants the next one won't be. So check the specific grant your buyer is going for, and ask in the first conversation so it doesn't throw things for a loop two days before you're supposed to close the deal.

‍

Second, build your territory model around the individual state calendars, not a single federal application cycle that's no longer applicable. Those calendars sit on state emergency management and homeland security agency sites, one page per state, each posted on its own schedule, and there's no central place that lists them. Each has its own window, its own match rules and its own clock, and in all three states we checked, the sub-award ends before the federal period does. Make sure you read the sub-grant, not just the federal award. The cost of skipping it isn't a lost deal, it's a missed window. Wisconsin's window closes October 30, and that round doesn't reopen. There are 55 other states and territories running their own version of that calendar.

‍

‍

Every ESSER-funded renewal in your base is a competitive deal again

Every ESSER spending window has now closed. ARP ESSER had to be obligated by September 30, 2024 and liquidated by January 28, 2025, with approved extensions running to late March 2026. ESSER I and II closed earlier, and the last round of extension fights settled in 2025. 

‍

A district that bought devices, licenses or staffing with ESSER now has to fund the renewal out of general funds or state money. The need doesn't go away, but everything around it changes — the buyer, the approval path, and how much scrutiny the price gets. That renewal used to have its own money behind it. Now it's in line with everything else the district needs to pay for. 

‍

What I'd do: Segment the K-12 base by original funding source before FY27 planning closes. ESSER-funded renewals need an earlier motion than you'd normally run, a business case written for a general-fund approver instead of a grant administrator, and an honest look at what happens to the price.

‍

Do that and your renewal number gets more reliable: you'll know which accounts need a real case made for them, and you'll still have the FY27 budget cycle in which to make it.

‍

‍

Medicaid is the only program here that adds pipeline

If state health and human services agencies are already in your territory, this is the section to act on. If they aren't, it's the one that might change your FY27 plan.

‍

Medicaid is different from the other three because the money doesn't expire. The federal government covers a fixed share of what a state spends on its Medicaid systems, 90% to design and build, 75% to run them, provided CMS, the federal agency that runs Medicaid, approves the project first, and that arrangement is permanent.

‍

Then the 2025 reconciliation law added work on top. By January 1, 2027, states have to verify that adults in the Medicaid expansion group are working, training or doing community service for at least 80 hours a month, or enrolled in school at least half-time, in order to keep their coverage. CMS calls it a community engagement requirement. Checking it means pulling payroll records, records of the care people received, and school enrollment data into one place and matching them against eligibility files.

‍

The work is required, the date is fixed, and the federal government covers most of what it costs to build. You don't see that combination often.

‍

What I'd do: If state health and human services agencies aren't in your FY27 territory plan, evaluate adding them this quarter. The compliance date is eleven weeks out, so this work is being scoped and built right now rather than sitting in a future RFP cycle. Get there while that's still true and you spend FY27 selling where the budget is already approved, the deadline is the buyer's own, and the federal government covers most of the cost.

‍

‍

Leave with these five things to change this quarter

First, run the Q4 commit against payment dates rather than close dates, for every ARPA-funded deal in it. December 31 is the expenditure deadline and it's eleven weeks out. It's the only item here with a number attached to this quarter.

‍

Second, add a funding-source field to the opportunity record if you don't already have one. The first and fourth items both depend on being able to tell which deals and which renewals were grant-funded. Without it, answering that question means going account by account. With it, it's a filter.

‍

Third, build SLED cyber coverage around state sub-grant calendars. The federal cycle your coverage model was built on no longer exists, and roughly $370 million is still being competed state by state into 2029.

‍

‍Fourth, segment the K-12 base by original funding source. ESSER-funded renewals need a general-fund business case, and FY27 planning is where that either gets built or gets missed.

‍

Fifth, add state health and human services agencies to the FY27 territory plan. They have a January 1, 2027 deadline to meet, and the federal government covers most of the cost of meeting it.

‍

None of these take a quarter to do. Start with the first one. It's an afternoon with your Q4 commit open, and it's the only one with a December deadline attached.

‍

‍

The reference chart

Program-level dates only. Sub-award terms are set state by state and run on their own clocks.

‍

‍

* ED's grantee guidance describes a 14-month extension window ending March 28, 2026; some state agencies and trade press cite March 30, 2026. Both dates are past.

‍

‍

Where this information comes from

Every date here is from the program's own documents — Treasury, FEMA, the Department of Education and CMS — plus three state agency pages, retrieved October 7-14, 2026.

‍

A few things to know before acting on it. SLCGP's recent legislative history is contested: sources differ on which extensions passed since September 2025, though all agree no new federal money has been appropriated. Award terms also vary by state, so read the actual sub-grant on a specific account. And the ESSER renewal piece is reasoning based on the deadlines.

‍

‍

Sources

All retrieved October 7-14, 2026.

• ‍Treasury, SLFRF Compliance and Reporting Guidance (v10.1, September 2025)
• ‍DHS/FEMA, FY2025 SLCGP Notice of Funding Opportunity (August 2025)‍
• FEMA, FY24 SLCGP Award Information Bulletin (September 2024)‍
• StateScoop, "Restoring SLCGP tops NASCIO's congressional priorities" (September 2026)‍
• Wisconsin Emergency Management, SLCGP Cycle 3 notice of funding opportunity‍
• Maryland Department of Emergency Management, cybersecurity funding announcement (August 2026)‍
• North Carolina Department of Public Safety, SLCGP program page‍
• U.S. Department of Education, ARP ESSER obligation deadlines and extensions (June 2024)‍
• Vermont Agency of Education, ARP ESSER liquidation extension memo‍
• MACPAC, State Medicaid Enterprise Systems issue brief (July 2026)‍
• CMS, Medicaid community engagement requirement interim final rule fact sheet (June 2026)‍
• Federal Register, Medicaid Program: Community Engagement Requirement for Certain Individuals (June 2026)